[PATCH] b43legacy: Fix rfkill allocation leakage in error paths

[PATCH] b43legacy: Fix rfkill allocation leakage in error paths

[Michael Buesch]

We must kill rfkill in any error paths that trigger after rfkill init.

Signed-off-by: Michael Buesch <mb@bu3sch.de>

---

John, please try to push this for 2.6.24. Seems quite important,
as it leaks resources and might crash the kernel.


Index: wireless-2.6/drivers/net/wireless/b43legacy/main.c
===================================================================
--- wireless-2.6.orig/drivers/net/wireless/b43legacy/main.c	2008-01-16 23:28:50.000000000 +0100
+++ wireless-2.6/drivers/net/wireless/b43legacy/main.c	2008-01-23 12:04:41.000000000 +0100
@@ -3218,38 +3218,45 @@ static void b43legacy_op_remove_interfac
 static int b43legacy_op_start(struct ieee80211_hw *hw)
 {
 	struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
 	struct b43legacy_wldev *dev = wl->current_dev;
 	int did_init = 0;
 	int err = 0;
+	bool do_rfkill_exit = 0;
 
 	/* First register RFkill.
 	 * LEDs that are registered later depend on it. */
 	b43legacy_rfkill_init(dev);
 
 	mutex_lock(&wl->mutex);
 
 	if (b43legacy_status(dev) < B43legacy_STAT_INITIALIZED) {
 		err = b43legacy_wireless_core_init(dev);
-		if (err)
+		if (err) {
+			do_rfkill_exit = 1;
 			goto out_mutex_unlock;
+		}
 		did_init = 1;
 	}
 
 	if (b43legacy_status(dev) < B43legacy_STAT_STARTED) {
 		err = b43legacy_wireless_core_start(dev);
 		if (err) {
 			if (did_init)
 				b43legacy_wireless_core_exit(dev);
+			do_rfkill_exit = 1;
 			goto out_mutex_unlock;
 		}
 	}
 
 out_mutex_unlock:
 	mutex_unlock(&wl->mutex);
 
+	if (do_rfkill_exit)
+		b43legacy_rfkill_exit(dev);
+
 	return err;
 }
 
 static void b43legacy_op_stop(struct ieee80211_hw *hw)
 {
 	struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);

Re: [PATCH] b43legacy: Fix rfkill allocation leakage in error paths

[Stefano Brivio]

On Wed, 23 Jan 2008 12:15:38 +0100
Michael Buesch <mb@bu3sch.de> wrote:

> We must kill rfkill in any error paths that trigger after rfkill init.
> 
> Signed-off-by: Michael Buesch <mb@bu3sch.de>

Acked-by: Stefano Brivio <stefano.brivio@polimi.it>


--
Ciao
Stefano